diff options
author | Stan Hu <stanhu@gmail.com> | 2017-12-07 23:49:55 -0800 |
---|---|---|
committer | Stan Hu <stanhu@gmail.com> | 2017-12-12 15:07:24 -0800 |
commit | ad3732955389024b8a209455f9a889d5ebf411b9 (patch) | |
tree | 6e134bba4bf8e1b47142eea474a2afb3f562552d /app/policies | |
parent | 87118872c94ab465d400090e247b1e4ae90c2d82 (diff) | |
download | gitlab-ce-ad3732955389024b8a209455f9a889d5ebf411b9.tar.gz |
Refactor common protected ref check
Diffstat (limited to 'app/policies')
-rw-r--r-- | app/policies/ci/pipeline_policy.rb | 16 | ||||
-rw-r--r-- | app/policies/ci/pipeline_schedule_policy.rb | 10 |
2 files changed, 10 insertions, 16 deletions
diff --git a/app/policies/ci/pipeline_policy.rb b/app/policies/ci/pipeline_policy.rb index 4e689a9efd5..6363c382ff8 100644 --- a/app/policies/ci/pipeline_policy.rb +++ b/app/policies/ci/pipeline_policy.rb @@ -2,16 +2,18 @@ module Ci class PipelinePolicy < BasePolicy delegate { @subject.project } - condition(:protected_ref) do - access = ::Gitlab::UserAccess.new(@user, project: @subject.project) + condition(:protected_ref) { ref_protected?(@user, @subject.project, @subject.tag?, @subject.ref) } - if @subject.tag? - !access.can_create_tag?(@subject.ref) + rule { protected_ref }.prevent :update_pipeline + + def ref_protected?(user, project, tag, ref) + access = ::Gitlab::UserAccess.new(user, project: project) + + if tag + !access.can_create_tag?(ref) else - !access.can_update_branch?(@subject.ref) + !access.can_update_branch?(ref) end end - - rule { protected_ref }.prevent :update_pipeline end end diff --git a/app/policies/ci/pipeline_schedule_policy.rb b/app/policies/ci/pipeline_schedule_policy.rb index c0a2bb963e9..abcf536b2f7 100644 --- a/app/policies/ci/pipeline_schedule_policy.rb +++ b/app/policies/ci/pipeline_schedule_policy.rb @@ -3,15 +3,7 @@ module Ci alias_method :pipeline_schedule, :subject condition(:protected_ref) do - access = ::Gitlab::UserAccess.new(@user, project: @subject.project) - - if @subject.project.repository.branch_exists?(@subject.ref) - !access.can_update_branch?(@subject.ref) - elsif @subject.project.repository.tag_exists?(@subject.ref) - !access.can_create_tag?(@subject.ref) - else - false - end + ref_protected?(@user, @subject.project, @subject.project.repository.tag_exists?(@subject.ref), @subject.ref) end condition(:owner_of_schedule) do |